Skip to contentVulnerabilities with public exploits
- arelleArelle < 2.39.10 Unauthenticated RCE via /rest/configureCVE-2026-42796Public exploit9.2 Critical
- patriksimek vm2, red hat developer hub, self-service automation portal 2 +2 moreVM2 Sandbox Breakout Through __lookupGetter__CVE-2026-24118Public exploitFix available9.8 Critical
- apache http server, red hat enterprise linux 10, enterprise linux 6 +5 more +7 moreApache HTTP Server: http2: double free and possible RCE on early resetCVE-2026-23918Public exploitFix availableEPSS 49.7%8.8 High
- apache http serverApache HTTP Server: mod_auth_digest timing attackCVE-2026-33006Public exploitFix available4.8 Medium
- ollamaOllama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackersCVE-2026-7482Public exploitFix available8.8 High
- apache http serverApache HTTP Server: mod_rewrite elevation of privileges via ap_exprCVE-2026-24072Public exploitFix available8.8 High
- code-projects bloodbank managing systemcode-projects BloodBank Managing System get_state.php sql injectionCVE-2026-7731Public exploit5.3 Medium
- prometheus, red hat file integrity operator, logging for red hat openshift 6 +53 more +55 morePrometheus: remote read endpoint allows denial of service via crafted snappy payloadCVE-2026-42154Public exploitFix available7.5 High
- devcode openstamanagerOpenSTAManager contains an arbitrary file upload vulnerability in its module update functionalityCVE-2026-38751Public exploit7.2 High
- codewise tornet scooter mobile appCodeWise Tornet Scooter Mobile App TwoFactor excessive authenticationCVE-2026-7671Public exploit6.3 Medium
- sgl-project sglangsgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injectionCVE-2026-7669Public exploit6.3 Medium
- cyberhobo geo mashupGeo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' ParameterCVE-2026-4060Public exploit7.5 High
- wpeverest user registration advanced fieldsUser Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File UploadCVE-2026-4882Public exploit9.8 Critical
- pickplugins user verification by pickpluginsUser Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API EndpointCVE-2026-7458Public exploit9.8 Critical
- argoproj argo cd, argo-cd, red hat openshift data foundation 4 +3 more +5 moreArgoCD ServerSideDiff is vulnerable to Kubernetes Secret ExtractionCVE-2026-42880Public exploitFix available9.6 Critical
- linux, linux kernel +1 moreusb: gadget: f_hid: move list and spinlock inits from bind to allocCVE-2026-31721Public exploitFix available5.5 Medium
- linux, linux kernel +1 moreusb: gadget: f_uac1_legacy: validate control request sizeCVE-2026-31720Public exploitFix available7.8 High
- linux, linux kernel +1 moreksmbd: validate owner of durable handle on reconnectCVE-2026-31717Public exploitFix available8.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more +3 morefuse: reject oversized dirents in page cacheCVE-2026-31694Public exploitFix available7.8 High
- boldgrid total upkeep – wordpress backup plugin plus restore & migrate by boldgridTotal Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback CancellationCVE-2026-3143Public exploit5.3 Medium
- apache minaApache MINA: CWE-502 Deserialization of Untrusted Data (take 2)CVE-2026-42778Public exploitFix available9.8 Critical
- apache minaApache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)CVE-2026-42779Public exploitFix available9.8 Critical
- elemntor temporary loginTemporary Login <= 1.0.0 - Authentication Bypass to Account TakeoverCVE-2026-7567Public exploit9.8 Critical
- No product listedUnsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17. The sync-invoke client ...CVE-2026-42471Public exploit8.1 High
- google androidIn adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual...CVE-2026-0073Public exploitFix available8.8 High
- No product listedCross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90....CVE-2025-69606Public exploit6.1 Medium
- gotenbergGotenberg vulnerable to argument injection via newlines in ExifTool metadata valuesCVE-2026-40281Public exploitFix available10.0 Critical
- cryptpadCryptPad unbounded WebSocket frame floodCVE-2025-51846Public exploit8.7 High
- linux, linux kernel +1 morexen/privcmd: fix double free via VMA splittingCVE-2026-31787Public exploitFix available7.8 High
- freebsdLocal privilege escalation via execve()CVE-2026-7270Public exploit7.8 High
- No product listedA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U...CVE-2026-36960Public exploit8.8 High
- u-speed n300 firmwareU-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the...CVE-2026-36959Public exploit7.5 High
- u-speed n300 firmwareA denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router. By sending a...CVE-2026-36958Public exploit7.5 High
- dbitnet dbit n300 t1 pro firmwareDbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via...CVE-2026-36957Public exploit7.5 High
- dbitnet dbit n300 t1 pro firmwareA Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the...CVE-2026-36956Public exploit8.8 High
krayin/laravel-crm PackagistKrayin CRM allows a remote attacker to execute arbitrary code via compose email functionCVE-2026-36340Public exploitFix available8.1 High- ckanCKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`CVE-2026-42031Public exploitFix available8.3 High
- n8nn8n: Prototype Pollution in XML Webhook Body Parser Leads to RCECVE-2026-42231Public exploitFix available9.4 Critical
- n8nn8n: Hijacking of Unauthenticated Chat ExecutionCVE-2026-42228Public exploitFix available6.3 Medium
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scriptingCVE-2026-7401Public exploit5.3 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injectionCVE-2026-7394Public exploit5.1 Medium
- sourcecodester pizzafy ecommerce systemSourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted uploadCVE-2026-7393Public exploit5.1 Medium
- sourcecodester pharmacy sales and inventory systemSourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injectionCVE-2026-7392Public exploit5.3 Medium
- cpanel, cpanel whm, wp squared +1 more +3 moreWebPros cPanel and WHM Authentication Bypass via Login FlowCVE-2026-41940In KEVPublic exploitEPSS 98.5%9.3 Critical
- modelcontextprotocol rust-sdkRMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportCVE-2026-42559Public exploitFix available8.8 High
- ollamaRemote Code Execution in Ollama via Update MechanismCVE-2026-42249Public exploit7.7 High
- ollamaMissing Signature Verification for Updates in OllamaCVE-2026-42248Public exploit7.7 High
- opennebulaA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0...CVE-2025-56537Public exploit6.1 Medium
- opennebulaA stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to...CVE-2025-56536Public exploit6.1 Medium
- opennebulaA cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute...CVE-2025-56535Public exploit6.1 Medium
- Show moreLoading…